I run a small business. When am I required to follow the Privacy Act?

Summarise with: ChatGPT Perplexity Microsoft Copilot

---

Table of Contents

• What is the meaning of ‘trading in personal information’?
• What constitutes ‘consent’ of an individual?
• Conclusion

In general, most small businesses will not be required to follow the regulations of the Privacy Act 1988 (the Act). There are, however, some exceptions to the rule. For example, a small business that generates revenue of $3M or less annually will be required to follow the rules and regulations of the Act if it is:

• A health service provider;
• Trading personal information, such as mailing lists;
• A contractor who provides a service under a Commonwealth contract;
• A ‘reporting entity’ as per the Anti-Money Laundering and Counter-Terrorism Financing Act 2006;
• Operating a residential tenancy database;
• An employee association recognised by the Fair Work (Registered Organisations) Act 2009;
• A business that is related to another business that is captured by the Act;
• A business that has opted to be covered by the Act

If your business falls into one of the above categories and turns over $3M or less, then the provisions of the Act will apply and you will be required to comply with the regulations of the Act.

Your business, if covered by the provisions of the Act, will have to comply with the Australian Privacy Principles (APPs).

What is the meaning of ‘trading in personal information’?

The idea of ‘trading in’ personal information relates to businesses that gather someone’s personal information from, or share someone’s personal information with, another person or business for some service, benefit or advantage. This can be in the form of a subsidy, a concession, etc. If you are unsure whether this applies to your business, speak with an experienced business lawyer.

If you buy, sell or barter personal information, it is likely that you are ‘trading’ in personal information. For instance, if someone offers to sell you a mailing list and you choose not to get the consent of the individuals on that list, you may be trading in personal information. Or, alternatively, if you share the details of clients with another individual or business to get a commercial benefit, this type of conduct may also constitute trading in personal information.

However, if a business discloses or becomes privy to personal information for some advantage, service or benefit, it will not be trading in personal information if the individuals have given their consent. Alternatively, if the law requires the business to collect or disclose personal information, it will also be exempt.

Any business trading in personal information will be required to strictly comply with the APPs of Act. Although adherence to the APPs does not prevent a business from collecting personal information generally, it does impose rules and guidelines as to the manner in which that information is dealt with.

Here is a useful Guide to privacy for small business and the APP guidelines.

What constitutes ‘consent’ of an individual?

Any business that buys or sells personal information and does not want to have to abide by the APPs will need to collect each individual’s consent before they make the purchase or complete the sale. Consent can come in various forms, so for further clarification you should speak with an experienced business lawyer.

Conclusion

As a small business owner, you need to stay aware of any changes in Australian Privacy law so that you do not accidently breach any of the applicable APPs. Contact your business lawyer or speak with an experienced business lawyer at LegalVision to get a fixed-fee quote for advice.